GitSpawn lets poisoned repositories run code through AI coding agents

A repository’s own `.git/config` can still trigger attacker-controlled code through Claude Code, Codex, Cursor, goose, and other AI coding agents before trust prompts, authentication, model calls, or tool approvals occur. Manifold Security’s GitSpawn research found eight flaws across seven agents; fixes are available for several tools, but Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained vulnerable during September testing. Source

Read the full article at the source.